CVE-2026-13129
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The vulnerability in an application that opens PDF files causes JavaScript to use a damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.
Risk Assessment
The risk involves the possibility of intentionally causing an application crash by opening a specially crafted PDF file, which can lead to denial of service (DoS) and potential system availability compromise.
Recommendation
It is recommended to immediately update the library or application to a version containing the fix for this vulnerability and to implement validation mechanisms for PDF file structure before processing.
Original NVD description (English source)
When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.